Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 4 subscribers
  • Views 6849 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

What is going on if DNS packets from China get blocked?

StefanHeymans

Hi folks,


I read this in our weekly UTM9 report:

Most blocked source IP address is 42.120.221.11 (China), port 53 (DNS), 161.684 packets blocked.

Destination IP is the internet interface on the Sophos.

So what does that mean? Why are they sending that much packets?

Kind regards,


Stefan



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to BAlfson

    Nope, destination port was always 28106...

    Time Action Rule Interface IN Interface OUT Source MAC Destination MAC Source IP Destination IP Protocol Length TTL Source Port Destination Port
    2016:04:29-19:30:44 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106
    2016:04:29-19:30:44 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106
    2016:04:29-19:30:44 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106
    2016:04:29-19:30:44 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106
    2016:04:29-19:32:13 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106
    2016:04:29-19:35:42 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106
    2016:04:29-19:40:44 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106
    2016:04:29-19:47:26 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106
    2016:04:29-19:50:05 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106
    2016:04:29-19:50:59 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106
    2016:04:29-19:30:44 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106
    2016:04:29-19:30:44 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106
    2016:04:29-19:30:44 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106
    2016:04:29-19:30:44 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106
    2016:04:29-19:32:13 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106
    2016:04:29-19:35:42 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106
    2016:04:29-19:40:44 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106
    2016:04:29-19:47:26 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106
    2016:04:29-19:50:05 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106
    2016:04:29-19:50:59 drop 60001 eth4.231 124 00:1f:9f:xx:xx:xx 00:1a:8c:xx:xx:xx 42.120.221.11 192.168.254.2 17 0x20 113 53 28106